Privacy Policy

1. General Information

MEDICOVER TECH S.R.L (hereinafter referred to as the “Holder” or “MedTech“) with registered office at str. Sergent Constantin Ghercu, nr. 1A, 1st floor, rooms E01.06-E01.19, The Bridge 2 building, sector 6, Bucharest, registered with the Trade Register Office under no. J40/3785/2020, with fiscal code 42402275 is the Personal Data Controller.

The MySynevo web application (hereinafter referred to as “MySynevo”/ “the Application”) is developed by MEDICOVER TECH S.R.L., and provides its users, who can be both patients (hereinafter referred to as “Patient Users”) and physicians (hereinafter referred to as “Physician Users”) with several functionalities, namely:

(i) providing information on the medical services offered by Synevo Romania S.R.L.;

(ii) communicating the results of medical laboratory tests performed within Synevo Romania S.R.L to Patient Users who have a MySynevo account as well as providing graphical evolution of the values of certain parameters;

(iii) purchasing of medical services provided by Synevo Romania S.R.L.;

(iv) scheduling in order to perform medical services within Synevo Romania S.R.L.;

(v) communicating the results of medical laboratory tests performed within Synevo Romania S.R.L. to Physician Users, to the extent requested by Patient Users;

(vi) the possibility for Patient Users to send an invitation to a physician from Synevo Romania S.R.L.’s database to enroll in the Application;

(vii) interaction between Physician Users and Synevo Romania S.R.L. physicians through the Application, through the submission of questions by Physician Users to Synevo Romania S.R.L.;

(viii) interaction between Physician Users and Patient Users through the application, at the initiative of the Physician Users;

(ix) the possibility for the Physician Users to recommend additional medical tests to patients;

(x) the possibility for Physician Users to add comments to the lab test results of Patient Users that they are connected with.

Each entity performs independent data processing in relation to MySynevo functionalities

For the functionalities referred to in bullets (i)-(vii) Synevo Romania acts as Data Controller and for the functionalities referred to in bullets (viii)-(x) Medicover Tech acts as Data Processor. In the present document, we set out the processing operations carried out by Medicover Tech in its capacity as Data Controller. Details of the processing carried out by Synevo Romania can be found here.

As Data Controller, the Data Controller shall at all times follow and ensure that the processing of personal data strictly complies with the principles and legislation on the protection of personal data, in particular the provisions of Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter “GDPR”/ “Data Protection Regulation”).

This version of the Privacy Policy is valid as of 9th of April 2025 and is intended to inform you about:

• personal data processing activities involving your data as a user of the MySynevo application, including MySynevo (Physician account) which are managed by Medicover Tech SRL;
• personal data processing activities carried out by Medicover Tech in order to carry out its activities as described below.

Medicover Tech may update this Privacy Policy at a later date, in which case it will inform data subjects via the Site/ MySynevo, including MySynevo (Physician account) of any changes before they become applicable.

All processing carried out in connection with the functionalities managed by Synevo Romania is described in Synevo Romania’s Privacy Policy, which can be found here. For a proper understanding of how data is processed by both Medicover Tech and Synevo Romania, please refer to the privacy policies of both companies.

1. Definitions

“Personal Data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or by one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

“MySynevo” means the web application which facilitates (i) the provision of information on the medical services offered by Synevo, (ii) the communication of the results of medical laboratory tests performed in Synevo laboratories by Patient Users who have a MySynevo account as well as the provision of graphical evolution of the values of certain parameters, (iii) the management of Synevo Customers’ personal data, (iv) the purchasing of online medical services provided by Synevo, (v) scheduling to perform medical services within Synevo Romania, (vi) communicating the results of medical laboratory tests performed within Synevo Romania to Physician Users, to the extent requested by Patient Users, (vii) the sending by a Patient User an invitation to enroll in the application a physician from the Synevo Romania database, (viii) interaction between Physician Users and Synevo Romania’s physicians through the application, by Physician Users asking questions to Synevo Romania, (ix) interaction between Physician Users and Patient Users through the application, at the initiative of Physician Users, (x) the possibility for Physician Users to recommend patients to perform additional medical tests. MySynevo provides differentiated information depending on the way the user registers in the application: through a general account or through a personal account (Client account) that allows access to medical data (results of the analyses performed within Synevo laboratories). The use of MySynevo is carried out in accordance with the Terms and Conditions of use of the MySynevo application available by accessing the link – Terms and Conditions.

MySynevo Users – represents both Physician Users and Patient Users.

Physician User – represents MySynevo Users who are specialists in the medical field (general practitioners, specialized physicians, etc.) and who practice their medical profession in compliance with the legislation in force.

Patient User – represents MySynevo users who may be both Synevo patients and individuals interested in the medical laboratory services offered by Synevo; only individuals with full capacity of exercise may be Patient Users.

“Processing” (and its derivatives, including without limitation “to process”) means any operation or set of operations performed upon Personal Data, including without limitation collecting, recording, storing, maintaining, altering, modifying, using, disclosing, accessing, transferring or destroying it.

“Visitor” means any person who accesses or uses MySynevo, including as a Patient User and/or Physician User.

1. Categories of Personal Data Processed

The categories of Personal Data processed depend on the nature pf the interactions and relationship you have with the Holder, respectively in relation to your access/use of MySynevo. Thus, the Holder may process the following categories of Personal Data for the following categories of data subjects:

1. In the case of MySynevo visitors, both Patient Users and Physician Users, if you access and/or use MySynevo, the following categories of Personal Data might be processed for the functionalities managed by Medicover Tech:

i.          In case of interaction between Physician Users and Patient Users through the MySynevo application, at the initiative of the Physician Users: (i) on the part of the Physician User: first name, last name, city, paraphase code, specialization, and (i) on the part of the Patient User: first name, last name, email address, telephone number, date of birth.

ii.         If Physician Users choose to recommend additional medical tests to patients: patient’s full name, type of tests recommended.

iii.        If Physician Users choose to add comments to the medical test results of a Patient User: name, surname.

2. In the case of visitors to Medicover Tech’s premises, the following personal data may be processed through the video surveillance system (CCTV):

Through use of the video surveillance systems, the Company collects and processes personal data of data subjects consisting of their image captured in the video recordings. It is also possible that, through the video recordings, any other data that identifies a natural person or at least makes him or her directly or indirectly identifiable may also be processed. By way of example, the following data may be extracted from the processed video images: date and time of access to the Medicover Tech premises, date and time of leaving the Medicover Tech premises, facial features (insofar as the images are clear), visible physical characteristics, physical features (hair color, hair length, approximate height, clothing worn, etc. ), giving and/or receiving money and/or documents, manner of interaction with other individuals and/or Medicover Tech employees (e.g. manner of interaction with Medicover Tech representatives, etc.), and any other data that may appear in the video surveillance images.

3. In the case of candidates for employment

3.1 In the case of candidates for employment, the following data may be processed: name, surname, sex, age, date of birth, nationality, signature, civil status data, telephone number, e-mail address, address, image, profession, job, professional training (e.g. diplomas, studies), position, direction, certifications, courses, aptitudes, hobbies, subjective and/or objective information obtained from references, as well as any other information provided by the candidate directly through the CV or indirectly during the recruitment process.

3.2 In addition to the categories of data mentioned above, for the purpose of requesting references on candidates, Medicover Tech may process the following categories of personal data belonging to the persons recommended by candidates: name and surname, position, job title, e-mail address and/or telephone number.

4. For contact persons/representatives of collaborators/potential collaborators

4.1 In the case of contact persons of (corporate) collaborators/potential collaborators, such as, in the context of initiating or managing the contractual relationship with them: name, surname, e-mail address, telephone number, position, place of work, profession.

4.2 In the case of the contact persons of collaborators, in the context of sending satisfaction questionnaires to the respective corporate clients regarding Medicover Tech services: name, surname, e-mail address.

4.3 In the case of the legal representatives of the collaborators, with a view to negotiating and/or concluding service provision contracts: name and surname of the legal representative, signature, place of work, profession, e-mail address, telephone number, and any other information that may result from certificates issued by the Trade Register.

IV. Purposes and Grounds for the Processing of Personal Data

Personal Data relating to the categories of data subjects referred to in Section III above, provided in the course of relations with the Data Controller, in the context of the provision of the services made available by Medicover Tech, may be processed by Medicover Tech directly and/or through its processors, for the following purposes and on the following grounds:

1.         If you are a visitor to MySynevo, both Patient Users and Physician Users, we may process your Personal Data as follows:

1.1 For the purpose of interaction between Medical Users and Patient Users through the MySynevo application, at the initiative of the Medical Users

Lawful basis: legitimate interest

1.2. For the purpose of the functionality by the Medical Users of the possibility of recommending patients to perform additional medical tests

Lawful basis: legitimate interest

1.3 For the purpose of offering Physician Users the possibility to add comments to the results of Patient Users that they are connected with via the MySynevo app. Note that comments from multiple Physician Users are only visible to the Patient User. Physician Users will not be able to view each other’s comments on a Patient User’s results.

Lawful basis: legitimate interest

2.         If you are a visitor to the Medicover Tech premises, we may process your Personal Data via the video surveillance system (CCTV) as follows:

2.1 In order to comply with legal obligations for the following purposes:

• Security and protection of property and persons;
• Preventing and combating crime;
• Carrying out the orders of public authorities;
• Fulfillment of legal obligations, such as but not limited to: depositing waste according to its type, as required by law, complying with mandatory medical rules, etc;
• Dealing with data subjects’ requests.

2.2. To fulfill the legitimate interests of Medicover Tech for the following purposes:

• Compliance with internal procedures and applicable law;
• Defense in court or in contentious proceedings of the Company’s interests;
• Performing internal audits;
• Performing maintenance of the video surveillance system;
• Obtaining evidence in the event of incidents or complaints, subject to the conditions and restrictions imposed by law;
• Security and protection of property and persons (where such processing is not a legal obligation);
• Carrying out the orders of public authorities (where such processing is not a legal obligation);
• Resolution of any other situations that may arise in the course of the company’s business and require, in order to resolve it, the viewing of video surveillance images.
• Preventing and combating crime (where such processing is not a legal obligation);
• Handling the requests of data subjects;

Lawful basis: legitimate interest

3.         If you are a candidate for employment we may process your data:

3.1 In order to comply with legal obligations for the following purposes:

• Monitoring / security access to Company premises;
• ensuring the security of objectives, goods and persons (video surveillance);
• Providing the necessary security measures to protect personal data and other sensitive information for the Company’s activity;
• Informing candidates and resolving data subjects’ requests exercised under the General Data Protection Regulation 2016/679/EU on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“GDPR”) or other applicable legal provisions;
• Archiving documents in accordance with legal provisions;
• Managing relations with public authorities or other entities providing a public service.

Lawful basis: legal obligation.

3.2 In order to take the necessary steps to conclude a contract for the following purposes:

• Carrying out specific recruitment activities for certain vacancies within Medicover Tech;
• Handling any enquiries regarding the recruitment of certain vacancies.

Lawful basis: fulfilment of the contract.

3.3 In order to fulfill the legitimate interests of the Holder for the following purposes:

• To fill vacancies, following the conclusion in this respect of a recruitment contract with recruitment and candidate selection agencies;
• The storage, during the recruitment process, of applications received from recruitment agencies;
• Selection of candidates, analyzing the reputation and integrity of candidates;
• The storage of data of candidates for which storage is not by consent;
• Testing of candidates.

Lawful basis: legitimate interest.

3.4 On the basis of consent for the following purposes:

• Storing your data in order to contact you for subsequent recruitment processes, compared to the one for which you applied;
• Requesting references for recruitment for certain positions.

Lawful basis: consent

4.         If you are the contact person/legal representative of collaborators/potential collaborators we may process your data:

4.1 In order to comply with legal obligations for the following purposes:

• Compliance with applicable Medicover Tech;
• Managing the systems and services offered by Medicover Tech;
• Meeting financial accounting and tax obligations;
• Resolving requests/complaints regarding the exercise of the rights you are entitled to in the context of the data processing indicated below in section X;
• Internal audit;
• Archiving documents as required by law;
• Managing relations with public authorities;

Lawful basis: legal obligation.

4.2 In order to fulfill the legitimate interests of the Holder for the following purposes:

• Initiating, respectively managing the contractual relationship with Medicover Tech’s collaborating/potential collaborating partners;
• Managing any other requests, complaints, suggestions.

Lawful basis: legitimate interest.

4.3 In order to execute the contract signed by the Data Controller and the collaborator for the following purposes:

• The negotiation and signing of contracts concluded by the legal representatives of the collaborators

Lawful basis: conclusion and performance of the contract.

5.         If you are a contact person of collaborators we may process your data:

5.1. in order to fulfill the legitimate interests of the Holder for the purpose of transmitting and obtaining information by means of satisfaction questionnaires addressed to corporate customers

Lawful basis: legitimate interest.

V. Recipients of Personal Data

In order to fulfill the processing purposes, the Holder may disclose certain categories of Personal Data to the following categories of recipients:

1. the data subject and/or his/her legal representatives;

2. the referring physician and other medical professionals involved in the medical act (in the case of Patient Data);

3. the representatives of Medicover Tech, the entities of the Group to which the Data Subject belongs;

4. contractual partners of Medicover Tech who are beneficiaries of the services provided by Medicover Tech, including, but not limited to: insurance companies, other contractual partners;

5. contractual partners of Medicover Tech who are service providers such as, but not limited to, marketing agencies, mass mailing services, Software as a Service services – platform designed for the provision of remote consulting services, information storage services in the form of databases – CRM, hosting services, external consultants in various fields such as accounting, tax, legal service providers, professional organizations, market research organizations, recruitment and placement agencies, etc.;

6. judicial or other public authorities/entities of any kind, international organizations, etc.

VI. Duration of processing of Personal Data

The Holder will process your Personal Data for the duration necessary to fulfill the purposes of the processing and thereafter in accordance with our internal policies as well as in order to comply with applicable legal obligations, including, but not limited to, provisions relating to the obligation to archive. The Data will also be stored in accordance with Medicover Tech’s internal policies that establish retention periods for data and documents.

It is possible that, following the fulfillment of the legal archiving obligation deadlines, the Holder may order the anonymization of the data, thus depriving them of their personal character and continue the processing of anonymized data for statistical purposes.

Upon expiry of the term provided for by internal policies or legal provisions in force, the personal data will be deleted.

VII. Transfer of Personal Data

Personal Data provided to Medicover Tech may be transferred outside Romania, to countries within the European Economic Area.

For specific information on the transfer of your data outside the European Economic Area, please send us a request to the address mentioned below in section X.

VIII. Security of Personal Data

The Holder attaches particular importance to the confidentiality and security of your Personal Data and intends to ensure the security of your Personal Data during the processing activities set out in this Privacy Policy. To this end, the Holder implements appropriate technical and organizational measures in order to ensure a level of security appropriate to the risks associated with the types of data processed and processing operations.

IX. Provision of Personal Data

The provision of Personal Data may be a contractual obligation or an obligation necessary for the conclusion/performance of a contract, it may be necessary in order to benefit from the services made available by Medicover Tecj, to browse MySynevo and to benefit from the facilities offered on this space. In some cases, the refusal to provide Personal Data may result in the impossibility to benefit from the services made available to you through MySynevo.

X. Rights of the Data Subject

With respect to the processing of Personal Data indicated in this Privacy Policy, each Data Subject shall have the following rights, as provided by applicable law:

1. the right to be informed – the right to receive minimum information regarding the processing activities carried out by the Holder, in compliance with legal requirements;
2. the right of access to personal data – the right to obtain from the data controller, upon request and under the conditions established by the law, a confirmation whether the data subject’s data are or not processed by the data controller, as well as other details regarding the processing activities;
3. the right to rectification – the right to obtain from the data controller the rectification of inaccurate personal data concerning the data subject, respectively to obtain the supplementation of incomplete personal data, including by providing an additional statement;
4. the right to erasure (“the right to be forgotten”) – the right to obtain from the data controller the deletion of the data subject’s personal data, without undue delay, as provided by the law;
5. the right to restrict processing – the right to obtain from the data controller the restriction of the processing activities, provided that the legal conditions are fulfilled;
6. the right to data portability, namely (i) the right to receive the personal data in a structured way, in a commonly used and easy-to-read format, as well as (ii) the right to have such data transmitted by Synevo to another data controller, provided that the legal conditions are fulfilled;
7. the right of opposition – the right to oppose at any time, for justified and legitimate reasons related to a particular situation, to the processing of a data subject’s data, except in cases where there are legal provisions stating otherwise; as far as direct marketing activities go, data subjects have the right to object to such processing at any time.
8. the right not to be subject to an automated individual decision – the right not to be subject to a decision based solely on automatic processing, including profiling, which produces legal effects that concern or similarly affect a data subject to a significant extent;
9. the right to lodge a complaint with the National Supervisory Authority for the Processing of Personal Data to exercise and defend any rights guaranteed by the relevant legislation, notwithstanding the possibility of addressing the competent courts of law.
10. the right of the data subject to withdraw their consent when processing activities are based on it; the withdrawal of the consent does not affect the legality of the processing carried out based on such consent before its withdrawal.

Furthermore, if the data is transferred outside the EEA (“European Economic Area”), the data subjects whose Personal Data are transferred, may request information from the data controller regarding the transfer guarantees.

To exercise the rights mentioned above, you can send a request to the following contact details:

• Address: str. Sergent Constantin Ghercu, nr. 1A, 1st floor, spaces E01.06-E01.19, The Bridge 2 building, sector 6, Bucharest
• E-mail: [email protected]

Also, for any further information on how your Personal Data are processed, please contact the Data Protection Officer at the e-mail address: [email protected]